{"id":"CVE-2026-98764","kind":"vulnerability","aliases":["CVE-2026-98764"],"related":[],"title":"Linux kernel: FunctionFS ioctl crashes on missing endpoint descriptor","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC\n\nWhen user space sets up FunctionFS with only full-speed descriptors\n(e.g., flags = FUNCTIONFS_HAS_FS_DESC) and the gadget operates at a\nhigher speed (such as USB_SPEED_HIGH or USB_SPEED_SUPER),\nconfig_ep_by_speed() detects that the function lacks descriptors for\nthe current speed, logs a warning, and falls back to full-speed\ndescriptors. The endpoint is then successfully enabled via\nusb_ep_enable(), and epfile->ep becomes valid.\n\nHowever, when user space subsequently issues the FUNCTIONFS_ENDPOINT_DESC\nioctl to query the endpoint descriptor, ffs_epfile_ioctl() selects the\ndescriptor index solely based on gadget->speed:\n\n\tswitch (epfile->ffs->gadget->speed) {\n\tcase USB_SPEED_SUPER:\n\tcase USB_SPEED_SUPER_PLUS:\n\t\tdesc_idx = 2;\n\t\tbreak;\n\tcase USB_SPEED_HIGH:\n\t\tdesc_idx = 1;\n\t\tbreak;\n\tdefault:\n\t\tdesc_idx = 0;\n\t}\n\tdesc = epfile->ep->descs[desc_idx];\n\tmemcpy(&desc1, desc, desc->bLength);\n\nBecause user space only supplied full-speed descriptors,\nepfile->ep->descs[1] is NULL. Dereferencing desc->bLength triggers an\nimmediate kernel NULL pointer dereference panic.\n\nFix this by falling back through lower speed descriptors if the current\nspeed descriptor was not supplied, matching the fallback logic in\nconfig_ep_by_speed() and historical f_fs behavior. If still missing,\nfall back to epfile->ep->ep->desc (the active descriptor), and return\n-EINVAL safely if no valid descriptor is found. In addition, mark desc\nas const to match struct usb_ep::desc and avoid discarding qualifiers.","summary":"A FunctionFS USB gadget set up with only full-speed descriptors can be made to dereference a NULL endpoint descriptor when user space issues the FUNCTIONFS_ENDPOINT_DESC ioctl at high or super speed. The result is a kernel NULL pointer dereference and panic, which takes the machine down.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","linux-kernel","other","usb-gadget"],"not_affected_if":["default-config","no-usb-gadget-functionfs"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream f_fs fix for FUNCTIONFS_ENDPOINT_DESC (the fix falls back through lower-speed descriptors and returns -EINVAL when none exist); the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-18T16:17:30+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:16:44+00:00","updated_at":"2026-10-25T05:16:44+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T05:16:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream f_fs fix for FUNCTIONFS_ENDPOINT_DESC (the fix falls back through lower-speed descriptors and returns -EINVAL when none exist); the exact fixed version is unknown from the sources.","reach":"local","title":"Linux kernel: FunctionFS ioctl crashes on missing endpoint descriptor","impact":"medium","summary":"A FunctionFS USB gadget set up with only full-speed descriptors can be made to dereference a NULL endpoint descriptor when user space issues the FUNCTIONFS_ENDPOINT_DESC ioctl at high or super speed. The result is a kernel NULL pointer dereference and panic, which takes the machine down.","category":"other","nicknames":[],"who_cares":["linux-kernel","usb-gadget","embedded"],"confidence":0.6,"needs_auth":"unknown","worst_case":"local user process crashes the kernel with a NULL dereference","analyst_note":"Check the kernel.org or NVD entry for the fixed stable kernel versions and whether any distro backports exist.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-usb-gadget-functionfs","default-config"],"who_is_affected":"Only systems that run a Linux kernel with the USB gadget FunctionFS driver in use, where user space configures FunctionFS with full-speed descriptors only and the gadget negotiates high or super speed. Typical desktops and servers without USB gadget functions loaded are unlikely to be exposed, but the sources do not confirm which configurations load f_fs.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":3946,"output_tokens":605,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-98764':12A,15A '0':227C '1':222C,251C '2':214C 'activ':307C 'addit':320C 'avoid':332C 'back':149C,269C,300C 'base':194C 'becom':168C 'behavior':295C 'blength':238C,256C 'break':215C,223C 'case':203C,207C,216C 'config':130C,287C 'const':324C 'crash':5A 'current':142C,276C 'cve':10A,13A 'default':224C 'derefer':40B,66B,90C,263C 'dereferenc':254C 'desc':52B,94C,112C,179C,212C,220C,225C,228C,231C,232C,236C,237C,250C,255C,305C,322C,330C 'desc1':235C 'descriptor':9A,35B,44B,106C,139C,154C,185C,191C,247C,273C,278C,308C,316C 'detect':134C 'discard':333C 'e.g':107C 'einval':311C 'embed':16B 'enabl':160C,164C 'endpoint':8A,43B,51B,93C,156C,178C,184C 'ep':131C,163C,167C,230C,249C,288C,303C,304C,329C 'epfil':166C,187C,199C,229C,248C,302C 'f':85C,293C 'fall':148C,268C,299C 'fallback':284C 'ffs':186C,200C 'fix':87C,265C 'flag':108C 'follow':78C 'found':318C 'fs':86C,111C,294C 'full':33B,104C,152C,245C 'full-spe':32B,103C,151C,244C 'function':137C 'functionf':3A,25B,50B,92C,100C,109C,177C 'gadget':23B,27B,84C,115C,196C,201C 'high':55B,125C,219C 'higher':119C 'histor':292C 'howev':170C 'idx':213C,221C,226C,233C 'immedi':259C 'index':192C 'ioctl':4A,53B,180C,188C 'issu':48B,175C 'kernel':2A,19B,63B,76C,260C 'lack':138C 'linux':1A,18B,75C 'linux-kernel':17B 'log':144C 'logic':285C 'lower':271C 'machin':72B 'made':38B 'mark':321C 'match':282C,326C 'memcpi':234C 'miss':7A,298C 'null':42B,64B,88C,253C,261C 'oper':116C 'panic':68B,264C 'plus':211C 'pointer':65B,89C,262C 'qualifi':334C 'queri':182C 'resolv':82C 'result':60B 'return':310C 'safe':312C 'select':189C 'set':28B,98C 'sole':193C 'space':47B,97C,173C,241C 'speed':34B,58B,105C,120C,124C,128C,133C,143C,153C,197C,202C,205C,209C,218C,246C,272C,277C,290C 'still':297C 'struct':327C 'subsequ':174C 'success':159C 'super':57B,129C,206C,210C 'suppli':243C,281C 'switch':198C 'take':70B 'trigger':257C 'usb':22B,26B,83C,123C,127C,162C,204C,208C,217C,328C 'usb-gadget':21B 'user':46B,96C,172C,240C 'valid':169C,315C 'via':161C 'vulner':79C 'warn':146C","nicknames":[],"mitigations":[],"who_affected":"Only systems that run a Linux kernel with the USB gadget FunctionFS driver in use, where user space configures FunctionFS with full-speed descriptors only and the gadget negotiates high or super speed. Typical desktops and servers without USB gadget functions loaded are unlikely to be exposed, but the sources do not confirm which configurations load f_fs.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98764","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98764","severity":null,"published_at":"2026-10-18T16:17:30+00:00","modified_at":"2026-10-21T13:21:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}